HIPAA Business Associate Agreements 2

Question 1

A cloud storage vendor hosts encrypted PHI for a covered entity but claims it cannot access the data. Under HIPAA, does this vendor require a BAA?

Accepted Answer

Yes, because it still creates, receives, maintains, or transmits PHI on behalf of the covered entity

Answer

A vendor that maintains PHI on behalf of a covered entity is a business associate regardless of whether it can access or decrypt the data.

Question 2

Which of the following is a required element in every Business Associate Agreement?

Accepted Answer

A prohibition on the business associate using or disclosing PHI beyond what is permitted by the agreement

Answer

BAAs must prohibit the business associate from using or disclosing PHI in any manner not permitted or required by the agreement.

Question 3

A business associate discovers a breach of unsecured PHI. Within how many calendar days must it notify the covered entity?

Accepted Answer

Without unreasonable delay and no later than 60 calendar days after discovery

Answer

The HIPAA Breach Notification Rule requires business associates to notify covered entities without unreasonable delay and within 60 calendar days of discovering a breach.

Question 4

What happens to a BAA when the underlying service contract between a covered entity and a business associate expires?

Accepted Answer

The BAA obligations typically terminate along with the service contract unless PHI return/destruction obligations remain

Answer

BAA obligations generally end when the contract ends, but the BAA must address return or destruction of PHI at termination.

Question 5

A payroll company processes employee health benefit deductions for a hospital. Is the payroll company a business associate of the hospital?

Accepted Answer

Yes, if it receives PHI in the course of performing payroll services

Answer

A payroll company becomes a business associate only if it receives PHI (e.g., health plan enrollment data) to perform its services.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Business Associate Agreements 2